mythsthe peopleTwitter2020social media / united states

everyone assumed:

our admin tool is internal, so only our own staff can use it

what was actually true:

An internal tool is used by whoever is signed in as your staff, and a phone call can arrange that.

how it happened

  1. whoyoung hackersposing as Twitter IT
  2. the gapstaff loginsMFA approved on a fake page
  3. then130 accounts45 tweeted a bitcoin scam
  4. the resultabout $118,000 in bitcoinand a regulator's report
the gap that let it happen the result

what everyone assumed

Every platform needs an internal tool for account problems: a user loses access to their email, a phone number changes, an account is hijacked. The tool is internal. It sits behind the company network, the VPN and two-step login, and only employees can open it. Outsiders would need to break in first, and the perimeter is built to stop that.

what happened

The New York State Department of Financial Services investigated the incident and published its report in October 2020. According to the report, on 14 July 2020 the attackers phoned Twitter employees pretending to be from the company’s IT department, saying they were responding to a problem with the VPN. They directed employees to a fake VPN login page, where the employees entered their credentials and some approved the two-step login prompt on their phones.

The first employee accounts they took over had no access to the tool they wanted. The attackers used Twitter’s intranet to find out who did, and on 15 July targeted those employees in the same way. NYDFS reports that more than 1,000 Twitter employees had access to the internal tools, which could show a user’s email address, phone number and IP address, change the email, reset the password and turn two-step login on or off.

On the afternoon of 15 July, verified accounts belonging to public figures and companies posted messages promising to double any bitcoin sent to them. NYDFS counts 130 accounts affected, 45 of which sent tweets. Twitter believed direct messages may have been accessed in up to 36 accounts, and account data was downloaded for 7. The scam collected about $118,000 in bitcoin, according to NYDFS, and regulated crypto companies blocked about 6,000 further transfers worth about $1.5 million.

step by step

  1. more than 1,000 employees can use an internal account toolIt can change an account's email, reset its password and switch off two-step login, per NYDFS.
  2. March 2020staff move to working from homeNYDFS found no meaningful compensating controls, and no chief security officer since December 2019.
  3. 14–15 July 2020callers posing as IT walk staff to a fake VPN pageSome approve the MFA prompt; the attackers then find employees with access to the tool.the assumption breaks here
  4. 15 July 2020famous accounts tweet a bitcoin scam130 accounts are hit, 45 tweet, and about $118,000 in bitcoin comes in, per NYDFS.

how it surfaced

The tweets were the attack, so it was public within minutes. Within about two hours Twitter stopped many verified accounts from tweeting. Three people were arrested in July and August 2020. Graham Ivan Clark, 17 at the time of the attack, took a plea deal on state charges in Florida in March 2021 and was sentenced to three years in a juvenile facility, according to WUSF.

NYDFS found that Twitter had no chief information security officer from December 2019, that the move to remote work in March 2020 came without meaningful compensating controls, and that its two-step login could be relayed by an attacker. After the attack, it reports, Twitter cut back access to the tools sharply, moved toward hardware security keys and hired a new security chief.

An internal tool belongs to whoever is signed in as your staff.

The perimeter held, in the sense that nobody broke through it. Employees opened it from the inside because a caller asked them to.

picture it at a company like yours

The company here is made up. The other two paths are not: they happened, and each links to the story.

your company
a normal dayYour staff use an internal admin page to help customers who are locked out of their accounts.
the gap nobody seesDozens of people can use it, because handing it out was easier than deciding who needs it.a support screen that shows everything
  1. in this story
    the day it mattersSomeone calls one of them as 'IT', and they sign in on a page that looks like yours.
    what it costs youThe caller now changes customers' email addresses and logins, in your company's name.
  2. or it goes like this
    howSupport agents are paid to photograph what their screen already shows.
    what leavescustomer identity documents and balanceswho ends up with itfraudsters who call your customers
    it happenedCoinbase, 2025
  3. or it goes like this
    howAn outside support team's access to your ticketing system is used by someone else.
    what leavesyears of attachments customers sent to supportwho ends up with itan extortion group
    it happenedDiscord, 2025

sources

  1. New York State Department of Financial Services: Twitter investigation report (October 2020)
  2. Help Net Security: Twitter employees were spear-phished over the phone (31 July 2020)
  3. WUSF: Tampa Twitter hacker sentenced to three years in prison, three years probation (16 March 2021)

← all myths

your turn

what you can do about it

  1. this week

    Count how many people can change a customer's email address or switch off their two-step login.

    That is the action that hands an account to someone else, so it belongs to a short list of named people. If the count is closer to the whole support team, start by removing the people who have not used it in the last three months. At Twitter the number was more than a thousand.

  2. go deeper

  3. if you're not sure where to start

    Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.

    open the checklist →

the letter · every two weeks

one access gap in your inbox, with the fix.

Every issue takes one way access creeps in, shows a real incident where it went wrong, and ends with one thing to check that week. Written for the people who run the tools, without a security team behind them.

  • 1one mechanism, explained plainly
  • 2one real incident, taken apart
  • 3one step you can take on Monday

get the next issue

One email every two weeks. Your address stays here and is never passed to vendors. One click to unsubscribe. Privacy.